@openchamber/web 1.4.2 → 1.4.4

package/server/index.js

@@ -6,6 +6,7 @@ import fs from 'fs';
 import http from 'http';
 import { fileURLToPath } from 'url';
 import os from 'os';
+import crypto from 'crypto';
 import { createUiAuth } from './lib/ui-auth.js';
 import { startCloudflareTunnel, printTunnelWarning, checkCloudflaredAvailable } from './lib/cloudflare-tunnel.js';
 
@@ -315,6 +316,76 @@ const writeSettingsToDisk = async (settings) => {
   }
 };
 
+const resolveDirectoryCandidate = (value) => {
+  if (typeof value !== 'string') {
+    return null;
+  }
+  const trimmed = value.trim();
+  if (!trimmed) {
+    return null;
+  }
+  const normalized = normalizeDirectoryPath(trimmed);
+  return path.resolve(normalized);
+};
+
+const validateDirectoryPath = async (candidate) => {
+  const resolved = resolveDirectoryCandidate(candidate);
+  if (!resolved) {
+    return { ok: false, error: 'Directory parameter is required' };
+  }
+  try {
+    const stats = await fsPromises.stat(resolved);
+    if (!stats.isDirectory()) {
+      return { ok: false, error: 'Specified path is not a directory' };
+    }
+    return { ok: true, directory: resolved };
+  } catch (error) {
+    const err = error;
+    if (err && typeof err === 'object' && err.code === 'ENOENT') {
+      return { ok: false, error: 'Directory not found' };
+    }
+    if (err && typeof err === 'object' && err.code === 'EACCES') {
+      return { ok: false, error: 'Access to directory denied' };
+    }
+    return { ok: false, error: 'Failed to validate directory' };
+  }
+};
+
+const resolveProjectDirectory = async (req) => {
+  const headerDirectory = typeof req.get === 'function' ? req.get('x-opencode-directory') : null;
+  const queryDirectory = Array.isArray(req.query?.directory)
+    ? req.query.directory[0]
+    : req.query?.directory;
+  const requested = headerDirectory || queryDirectory || null;
+
+  if (requested) {
+    const validated = await validateDirectoryPath(requested);
+    if (!validated.ok) {
+      return { directory: null, error: validated.error };
+    }
+    return { directory: validated.directory, error: null };
+  }
+
+  const settings = await readSettingsFromDiskMigrated();
+  const projects = sanitizeProjects(settings.projects) || [];
+  if (projects.length === 0) {
+    return { directory: null, error: 'Directory parameter or active project is required' };
+  }
+
+  const activeId = typeof settings.activeProjectId === 'string' ? settings.activeProjectId : '';
+  const active = projects.find((project) => project.id === activeId) || projects[0];
+  if (!active || !active.path) {
+    return { directory: null, error: 'Directory parameter or active project is required' };
+  }
+
+  const validated = await validateDirectoryPath(active.path);
+  if (!validated.ok) {
+    return { directory: null, error: validated.error };
+  }
+
+  return { directory: validated.directory, error: null };
+};
+
 const sanitizeTypographySizesPartial = (input) => {
   if (!input || typeof input !== 'object') {
     return undefined;
@@ -384,6 +455,67 @@ const sanitizeSkillCatalogs = (input) => {
   return result;
 };
 
+const sanitizeProjects = (input) => {
+  if (!Array.isArray(input)) {
+    return undefined;
+  }
+
+  const result = [];
+  const seenIds = new Set();
+  const seenPaths = new Set();
+
+  for (const entry of input) {
+    if (!entry || typeof entry !== 'object') continue;
+
+    const candidate = entry;
+    const id = typeof candidate.id === 'string' ? candidate.id.trim() : '';
+    const rawPath = typeof candidate.path === 'string' ? candidate.path.trim() : '';
+    const normalizedPath = rawPath ? path.resolve(normalizeDirectoryPath(rawPath)) : '';
+    const label = typeof candidate.label === 'string' ? candidate.label.trim() : '';
+    const addedAt = Number.isFinite(candidate.addedAt) ? Number(candidate.addedAt) : null;
+    const lastOpenedAt = Number.isFinite(candidate.lastOpenedAt)
+      ? Number(candidate.lastOpenedAt)
+      : null;
+
+    if (!id || !normalizedPath) continue;
+    if (seenIds.has(id)) continue;
+    if (seenPaths.has(normalizedPath)) continue;
+
+    seenIds.add(id);
+    seenPaths.add(normalizedPath);
+
+    const project = {
+      id,
+      path: normalizedPath,
+      ...(label ? { label } : {}),
+      ...(Number.isFinite(addedAt) && addedAt >= 0 ? { addedAt } : {}),
+      ...(Number.isFinite(lastOpenedAt) && lastOpenedAt >= 0 ? { lastOpenedAt } : {}),
+    };
+
+    // Preserve worktreeDefaults
+    if (candidate.worktreeDefaults && typeof candidate.worktreeDefaults === 'object') {
+      const wt = candidate.worktreeDefaults;
+      const defaults = {};
+      if (typeof wt.branchPrefix === 'string' && wt.branchPrefix.trim()) {
+        defaults.branchPrefix = wt.branchPrefix.trim();
+      }
+      if (typeof wt.baseBranch === 'string' && wt.baseBranch.trim()) {
+        defaults.baseBranch = wt.baseBranch.trim();
+      }
+      if (typeof wt.autoCreateWorktree === 'boolean') {
+        defaults.autoCreateWorktree = wt.autoCreateWorktree;
+      }
+      if (Object.keys(defaults).length > 0) {
+        project.worktreeDefaults = defaults;
+      }
+    }
+
+    result.push(project);
+  }
+
+  return result;
+};
+
 const sanitizeSettingsUpdate = (payload) => {
   if (!payload || typeof payload !== 'object') {
     return {};
@@ -413,6 +545,15 @@ const sanitizeSettingsUpdate = (payload) => {
   if (typeof candidate.homeDirectory === 'string' && candidate.homeDirectory.length > 0) {
     result.homeDirectory = candidate.homeDirectory;
   }
+  if (Array.isArray(candidate.projects)) {
+    const projects = sanitizeProjects(candidate.projects);
+    if (projects) {
+      result.projects = projects;
+    }
+  }
+  if (typeof candidate.activeProjectId === 'string' && candidate.activeProjectId.length > 0) {
+    result.activeProjectId = candidate.activeProjectId;
+  }
 
   if (Array.isArray(candidate.approvedDirectories)) {
     result.approvedDirectories = normalizeStringArray(candidate.approvedDirectories);
@@ -458,6 +599,9 @@ const sanitizeSettingsUpdate = (payload) => {
   if (typeof candidate.queueModeEnabled === 'boolean') {
     result.queueModeEnabled = candidate.queueModeEnabled;
   }
+  if (typeof candidate.autoCreateWorktree === 'boolean') {
+    result.autoCreateWorktree = candidate.autoCreateWorktree;
+  }
 
   const skillCatalogs = sanitizeSkillCatalogs(candidate.skillCatalogs);
   if (skillCatalogs) {
@@ -481,6 +625,16 @@ const mergePersistedSettings = (current, changes) => {
   if (typeof changes.homeDirectory === 'string' && changes.homeDirectory.length > 0) {
     additionalApproved.push(changes.homeDirectory);
   }
+  const projectEntries = Array.isArray(changes.projects)
+    ? changes.projects
+    : Array.isArray(current.projects)
+      ? current.projects
+      : [];
+  projectEntries.forEach((project) => {
+    if (project && typeof project.path === 'string' && project.path.length > 0) {
+      additionalApproved.push(project.path);
+    }
+  });
   const approvedSource = [...baseApproved, ...additionalApproved];
 
   const baseBookmarks = Array.isArray(changes.securityScopedBookmarks)
@@ -535,10 +689,124 @@ const formatSettingsResponse = (settings) => {
   };
 };
 
+const validateProjectEntries = async (projects) => {
+  if (!Array.isArray(projects)) {
+    return [];
+  }
+
+  const results = [];
+  for (const project of projects) {
+    if (!project || typeof project.path !== 'string' || project.path.length === 0) {
+      continue;
+    }
+    try {
+      const stats = await fsPromises.stat(project.path);
+      if (!stats.isDirectory()) {
+        continue;
+      }
+      results.push(project);
+    } catch (error) {
+      const err = error;
+      if (err && typeof err === 'object' && err.code === 'ENOENT') {
+        continue;
+      }
+      continue;
+    }
+  }
+
+  return results;
+};
+
+const migrateSettingsFromLegacyLastDirectory = async (current) => {
+  const settings = current && typeof current === 'object' ? current : {};
+  const now = Date.now();
+
+  const sanitizedProjects = sanitizeProjects(settings.projects) || [];
+  let nextProjects = sanitizedProjects;
+  let nextActiveProjectId =
+    typeof settings.activeProjectId === 'string' ? settings.activeProjectId : undefined;
+
+  let changed = false;
+
+  if (nextProjects.length === 0) {
+    const legacy = typeof settings.lastDirectory === 'string' ? settings.lastDirectory.trim() : '';
+    const candidate = legacy ? resolveDirectoryCandidate(legacy) : null;
+
+    if (candidate) {
+      try {
+        const stats = await fsPromises.stat(candidate);
+        if (stats.isDirectory()) {
+          const id = crypto.randomUUID();
+          nextProjects = [
+            {
+              id,
+              path: candidate,
+              addedAt: now,
+              lastOpenedAt: now,
+            },
+          ];
+          nextActiveProjectId = id;
+          changed = true;
+        }
+      } catch {
+        // ignore invalid lastDirectory
+      }
+    }
+  }
+
+  if (nextProjects.length > 0) {
+    const active = nextProjects.find((project) => project.id === nextActiveProjectId) || null;
+    if (!active) {
+      nextActiveProjectId = nextProjects[0].id;
+      changed = true;
+    }
+  } else if (nextActiveProjectId) {
+    nextActiveProjectId = undefined;
+    changed = true;
+  }
+
+  if (!changed) {
+    return { settings, changed: false };
+  }
+
+  const merged = mergePersistedSettings(settings, {
+    ...settings,
+    projects: nextProjects,
+    ...(nextActiveProjectId ? { activeProjectId: nextActiveProjectId } : { activeProjectId: undefined }),
+  });
+
+  return { settings: merged, changed: true };
+};
+
+const readSettingsFromDiskMigrated = async () => {
+  const current = await readSettingsFromDisk();
+  const { settings, changed } = await migrateSettingsFromLegacyLastDirectory(current);
+  if (changed) {
+    await writeSettingsToDisk(settings);
+  }
+  return settings;
+};
+
 const persistSettings = async (changes) => {
   const current = await readSettingsFromDisk();
   const sanitized = sanitizeSettingsUpdate(changes);
-  const next = mergePersistedSettings(current, sanitized);
+  let next = mergePersistedSettings(current, sanitized);
+
+  if (Array.isArray(next.projects)) {
+    const validated = await validateProjectEntries(next.projects);
+    next = { ...next, projects: validated };
+  }
+
+  if (Array.isArray(next.projects) && next.projects.length > 0) {
+    const activeId = typeof next.activeProjectId === 'string' ? next.activeProjectId : '';
+    const active = next.projects.find((project) => project.id === activeId) || null;
+    if (!active) {
+      next = { ...next, activeProjectId: next.projects[0].id };
+    }
+  } else if (next.activeProjectId) {
+    next = { ...next, activeProjectId: undefined };
+  }
+
   await writeSettingsToDisk(next);
   return formatSettingsResponse(next);
 };
@@ -551,7 +819,7 @@ const getHmrState = () => {
     globalThis[HMR_STATE_KEY] = {
       openCodeProcess: null,
       openCodePort: null,
-      openCodeWorkingDirectory: process.cwd(),
+      openCodeWorkingDirectory: os.homedir(),
       isShuttingDown: false,
       signalsAttached: false,
     };
@@ -937,7 +1205,16 @@ function parseSseDataPayload(block) {
   }
 
   try {
-    return JSON.parse(payloadText);
+    const parsed = JSON.parse(payloadText);
+    if (
+      parsed &&
+      typeof parsed === 'object' &&
+      typeof parsed.payload === 'object' &&
+      parsed.payload !== null
+    ) {
+      return parsed.payload;
+    }
+    return parsed;
   } catch {
     return null;
   }
@@ -950,7 +1227,7 @@ function deriveSessionActivity(payload) {
 
   if (payload.type === 'session.status') {
     const status = payload.properties?.status;
-    const sessionId = payload.properties?.sessionID;
+    const sessionId = payload.properties?.sessionID ?? payload.properties?.sessionId;
     const statusType = status?.type;
 
     if (typeof sessionId === 'string' && sessionId.length > 0 && typeof statusType === 'string') {
@@ -961,7 +1238,17 @@ function deriveSessionActivity(payload) {
 
   if (payload.type === 'message.updated') {
     const info = payload.properties?.info;
-    const sessionId = info?.sessionID;
+    const sessionId = info?.sessionID ?? info?.sessionId ?? payload.properties?.sessionID ?? payload.properties?.sessionId;
+    const role = info?.role;
+    const finish = info?.finish;
+    if (typeof sessionId === 'string' && sessionId.length > 0 && role === 'assistant' && finish === 'stop') {
+      return { sessionId, phase: 'cooldown' };
+    }
+  }
+
+  if (payload.type === 'message.part.updated') {
+    const info = payload.properties?.info;
+    const sessionId = info?.sessionID ?? info?.sessionId ?? payload.properties?.sessionID ?? payload.properties?.sessionId;
     const role = info?.role;
     const finish = info?.finish;
     if (typeof sessionId === 'string' && sessionId.length > 0 && role === 'assistant' && finish === 'stop') {
@@ -970,7 +1257,7 @@ function deriveSessionActivity(payload) {
   }
 
   if (payload.type === 'session.idle') {
-    const sessionId = payload.properties?.sessionID;
+    const sessionId = payload.properties?.sessionID ?? payload.properties?.sessionId;
     if (typeof sessionId === 'string' && sessionId.length > 0) {
       return { sessionId, phase: 'idle' };
     }
@@ -2072,11 +2359,124 @@ async function main(options = {}) {
     }
   });
 
-  app.get('/api/event', async (req, res) => {
-    if (!openCodePort) {
+  app.get('/api/global/event', async (req, res) => {
+    if (!openCodeApiPrefixDetected) {
+      try {
+        await detectOpenCodeApiPrefix();
+      } catch {
+        // ignore detection failures
+      }
+    }
+
+    let targetUrl;
+    try {
+      const prefix = openCodeApiPrefixDetected ? openCodeApiPrefix : '';
+      targetUrl = new URL(buildOpenCodeUrl('/global/event', prefix));
+    } catch (error) {
       return res.status(503).json({ error: 'OpenCode service unavailable' });
     }
 
+    const headers = {
+      Accept: 'text/event-stream',
+      'Cache-Control': 'no-cache',
+      Connection: 'keep-alive'
+    };
+
+    const lastEventId = req.header('Last-Event-ID');
+    if (typeof lastEventId === 'string' && lastEventId.length > 0) {
+      headers['Last-Event-ID'] = lastEventId;
+    }
+
+    const controller = new AbortController();
+    const cleanup = () => {
+      if (!controller.signal.aborted) {
+        controller.abort();
+      }
+    };
+
+    req.on('close', cleanup);
+    req.on('error', cleanup);
+
+    let upstream;
+    try {
+      upstream = await fetch(targetUrl.toString(), {
+        headers,
+        signal: controller.signal,
+      });
+    } catch (error) {
+      return res.status(502).json({ error: 'Failed to connect to OpenCode event stream' });
+    }
+
+    if (!upstream.ok || !upstream.body) {
+      return res.status(502).json({ error: `OpenCode event stream unavailable (${upstream.status})` });
+    }
+
+    res.setHeader('Content-Type', 'text/event-stream');
+    res.setHeader('Cache-Control', 'no-cache');
+    res.setHeader('Connection', 'keep-alive');
+    res.setHeader('X-Accel-Buffering', 'no');
+
+    if (typeof res.flushHeaders === 'function') {
+      res.flushHeaders();
+    }
+
+    const heartbeatInterval = setInterval(() => {
+      writeSseEvent(res, { type: 'openchamber:heartbeat', timestamp: Date.now() });
+    }, 30000);
+
+    const decoder = new TextDecoder();
+    const reader = upstream.body.getReader();
+    let buffer = '';
+
+    const forwardBlock = (block) => {
+      if (!block) return;
+      res.write(`${block}\n\n`);
+      const payload = parseSseDataPayload(block);
+      const activity = deriveSessionActivity(payload);
+      if (activity) {
+        writeSseEvent(res, {
+          type: 'openchamber:session-activity',
+          properties: {
+            sessionId: activity.sessionId,
+            phase: activity.phase,
+          }
+        });
+      }
+    };
+
+    try {
+      while (true) {
+        const { value, done } = await reader.read();
+        if (done) break;
+        buffer += decoder.decode(value, { stream: true }).replace(/\r\n/g, '\n');
+
+        let separatorIndex;
+        while ((separatorIndex = buffer.indexOf('\n\n')) !== -1) {
+          const block = buffer.slice(0, separatorIndex);
+          buffer = buffer.slice(separatorIndex + 2);
+          forwardBlock(block);
+        }
+      }
+
+      if (buffer.trim().length > 0) {
+        forwardBlock(buffer.trim());
+      }
+    } catch (error) {
+      if (!controller.signal.aborted) {
+        console.warn('SSE proxy stream error:', error);
+      }
+    } finally {
+      clearInterval(heartbeatInterval);
+      cleanup();
+      try {
+        res.end();
+      } catch {
+        // ignore
+      }
+    }
+  });
+
+  app.get('/api/event', async (req, res) => {
     if (!openCodeApiPrefixDetected) {
       try {
         await detectOpenCodeApiPrefix();
@@ -2093,11 +2493,13 @@ async function main(options = {}) {
       return res.status(503).json({ error: 'OpenCode service unavailable' });
     }
 
+    const headerDirectory = typeof req.get === 'function' ? req.get('x-opencode-directory') : null;
     const directoryParam = Array.isArray(req.query.directory)
       ? req.query.directory[0]
       : req.query.directory;
-    if (typeof directoryParam === 'string' && directoryParam.trim().length > 0) {
-      targetUrl.searchParams.set('directory', directoryParam.trim());
+    const resolvedDirectory = headerDirectory || directoryParam || null;
+    if (typeof resolvedDirectory === 'string' && resolvedDirectory.trim().length > 0) {
+      targetUrl.searchParams.set('directory', resolvedDirectory.trim());
     }
 
     const headers = {
@@ -2144,6 +2546,10 @@ async function main(options = {}) {
       res.flushHeaders();
     }
 
+    const heartbeatInterval = setInterval(() => {
+      writeSseEvent(res, { type: 'openchamber:heartbeat', timestamp: Date.now() });
+    }, 30000);
+
     const decoder = new TextDecoder();
     const reader = upstream.body.getReader();
     let buffer = '';
@@ -2186,6 +2592,7 @@ async function main(options = {}) {
         console.warn('SSE proxy stream error:', error);
       }
     } finally {
+      clearInterval(heartbeatInterval);
       cleanup();
       try {
         res.end();
@@ -2197,7 +2604,7 @@ async function main(options = {}) {
 
   app.get('/api/config/settings', async (_req, res) => {
     try {
-      const settings = await readSettingsFromDisk();
+      const settings = await readSettingsFromDiskMigrated();
       res.json(formatSettingsResponse(settings));
     } catch (error) {
       console.error('Failed to load settings:', error);
@@ -2218,6 +2625,7 @@ async function main(options = {}) {
   const {
     getAgentSources,
     getAgentScope,
+    getAgentConfig,
     createAgent,
     updateAgent,
     deleteAgent,
@@ -2230,16 +2638,23 @@ async function main(options = {}) {
     COMMAND_SCOPE
   } = await import('./lib/opencode-config.js');
 
-  app.get('/api/config/agents/:name', (req, res) => {
+  app.get('/api/config/agents/:name', async (req, res) => {
     try {
       const agentName = req.params.name;
-      const workingDirectory = req.query.directory || openCodeWorkingDirectory;
-      const sources = getAgentSources(agentName, workingDirectory);
+      const { directory, error } = await resolveProjectDirectory(req);
+      if (!directory) {
+        return res.status(400).json({ error });
+      }
+      const sources = getAgentSources(agentName, directory);
+
+      const scope = sources.md.exists
+        ? sources.md.scope
+        : (sources.json.exists ? sources.json.scope : null);
 
       res.json({
         name: agentName,
         sources: sources,
-        scope: sources.md.scope,
+        scope,
         isBuiltIn: !sources.md.exists && !sources.json.exists
       });
     } catch (error) {
@@ -2248,17 +2663,36 @@ async function main(options = {}) {
     }
   });
 
+  app.get('/api/config/agents/:name/config', async (req, res) => {
+    try {
+      const agentName = req.params.name;
+      const { directory, error } = await resolveProjectDirectory(req);
+      if (!directory) {
+        return res.status(400).json({ error });
+      }
+
+      const configInfo = getAgentConfig(agentName, directory);
+      res.json(configInfo);
+    } catch (error) {
+      console.error('Failed to get agent config:', error);
+      res.status(500).json({ error: 'Failed to get agent configuration' });
+    }
+  });
+
   app.post('/api/config/agents/:name', async (req, res) => {
     try {
       const agentName = req.params.name;
       const { scope, ...config } = req.body;
-      const workingDirectory = req.query.directory || openCodeWorkingDirectory;
+      const { directory, error } = await resolveProjectDirectory(req);
+      if (!directory) {
+        return res.status(400).json({ error });
+      }
 
       console.log('[Server] Creating agent:', agentName);
       console.log('[Server] Config received:', JSON.stringify(config, null, 2));
-      console.log('[Server] Scope:', scope, 'Working directory:', workingDirectory);
+      console.log('[Server] Scope:', scope, 'Working directory:', directory);
 
-      createAgent(agentName, config, workingDirectory, scope);
+      createAgent(agentName, config, directory, scope);
       await refreshOpenCodeAfterConfigChange('agent creation', {
         agentName
       });
@@ -2279,13 +2713,16 @@ async function main(options = {}) {
     try {
       const agentName = req.params.name;
       const updates = req.body;
-      const workingDirectory = req.query.directory || openCodeWorkingDirectory;
+      const { directory, error } = await resolveProjectDirectory(req);
+      if (!directory) {
+        return res.status(400).json({ error });
+      }
 
       console.log(`[Server] Updating agent: ${agentName}`);
       console.log('[Server] Updates:', JSON.stringify(updates, null, 2));
-      console.log('[Server] Working directory:', workingDirectory);
+      console.log('[Server] Working directory:', directory);
 
-      updateAgent(agentName, updates, workingDirectory);
+      updateAgent(agentName, updates, directory);
       await refreshOpenCodeAfterConfigChange('agent update');
 
       console.log(`[Server] Agent ${agentName} updated successfully`);
@@ -2306,9 +2743,12 @@ async function main(options = {}) {
   app.delete('/api/config/agents/:name', async (req, res) => {
     try {
       const agentName = req.params.name;
-      const workingDirectory = req.query.directory || openCodeWorkingDirectory;
+      const { directory, error } = await resolveProjectDirectory(req);
+      if (!directory) {
+        return res.status(400).json({ error });
+      }
 
-      deleteAgent(agentName, workingDirectory);
+      deleteAgent(agentName, directory);
       await refreshOpenCodeAfterConfigChange('agent deletion');
 
       res.json({
@@ -2323,16 +2763,23 @@ async function main(options = {}) {
     }
   });
 
-  app.get('/api/config/commands/:name', (req, res) => {
+  app.get('/api/config/commands/:name', async (req, res) => {
     try {
       const commandName = req.params.name;
-      const workingDirectory = req.query.directory || openCodeWorkingDirectory;
-      const sources = getCommandSources(commandName, workingDirectory);
+      const { directory, error } = await resolveProjectDirectory(req);
+      if (!directory) {
+        return res.status(400).json({ error });
+      }
+      const sources = getCommandSources(commandName, directory);
+
+      const scope = sources.md.exists
+        ? sources.md.scope
+        : (sources.json.exists ? sources.json.scope : null);
 
       res.json({
         name: commandName,
         sources: sources,
-        scope: sources.md.scope,
+        scope,
         isBuiltIn: !sources.md.exists && !sources.json.exists
       });
     } catch (error) {
@@ -2345,13 +2792,16 @@ async function main(options = {}) {
     try {
       const commandName = req.params.name;
       const { scope, ...config } = req.body;
-      const workingDirectory = req.query.directory || openCodeWorkingDirectory;
+      const { directory, error } = await resolveProjectDirectory(req);
+      if (!directory) {
+        return res.status(400).json({ error });
+      }
 
       console.log('[Server] Creating command:', commandName);
       console.log('[Server] Config received:', JSON.stringify(config, null, 2));
-      console.log('[Server] Scope:', scope, 'Working directory:', workingDirectory);
+      console.log('[Server] Scope:', scope, 'Working directory:', directory);
 
-      createCommand(commandName, config, workingDirectory, scope);
+      createCommand(commandName, config, directory, scope);
       await refreshOpenCodeAfterConfigChange('command creation', {
         commandName
       });
@@ -2372,13 +2822,16 @@ async function main(options = {}) {
     try {
       const commandName = req.params.name;
       const updates = req.body;
-      const workingDirectory = req.query.directory || openCodeWorkingDirectory;
+      const { directory, error } = await resolveProjectDirectory(req);
+      if (!directory) {
+        return res.status(400).json({ error });
+      }
 
       console.log(`[Server] Updating command: ${commandName}`);
       console.log('[Server] Updates:', JSON.stringify(updates, null, 2));
-      console.log('[Server] Working directory:', workingDirectory);
+      console.log('[Server] Working directory:', directory);
 
-      updateCommand(commandName, updates, workingDirectory);
+      updateCommand(commandName, updates, directory);
       await refreshOpenCodeAfterConfigChange('command update');
 
       console.log(`[Server] Command ${commandName} updated successfully`);
@@ -2399,9 +2852,12 @@ async function main(options = {}) {
   app.delete('/api/config/commands/:name', async (req, res) => {
     try {
       const commandName = req.params.name;
-      const workingDirectory = req.query.directory || openCodeWorkingDirectory;
+      const { directory, error } = await resolveProjectDirectory(req);
+      if (!directory) {
+        return res.status(400).json({ error });
+      }
 
-      deleteCommand(commandName, workingDirectory);
+      deleteCommand(commandName, directory);
       await refreshOpenCodeAfterConfigChange('command deletion');
 
       res.json({
@@ -2432,14 +2888,17 @@ async function main(options = {}) {
   } = await import('./lib/opencode-config.js');
 
   // List all discovered skills
-  app.get('/api/config/skills', (req, res) => {
+  app.get('/api/config/skills', async (req, res) => {
     try {
-      const workingDirectory = req.query.directory || openCodeWorkingDirectory;
-      const skills = discoverSkills(workingDirectory);
+      const { directory, error } = await resolveProjectDirectory(req);
+      if (!directory) {
+        return res.status(400).json({ error });
+      }
+      const skills = discoverSkills(directory);
       
       // Enrich with full sources info
       const enrichedSkills = skills.map(skill => {
-        const sources = getSkillSources(skill.name, workingDirectory);
+        const sources = getSkillSources(skill.name, directory);
         return {
           ...skill,
           sources
@@ -2489,7 +2948,10 @@ async function main(options = {}) {
 
   app.get('/api/config/skills/catalog', async (req, res) => {
     try {
-      const workingDirectory = req.query.directory || openCodeWorkingDirectory;
+      const { directory, error } = await resolveProjectDirectory(req);
+      if (!directory) {
+        return res.status(400).json({ error });
+      }
       const refresh = String(req.query.refresh || '').toLowerCase() === 'true';
 
       const curatedSources = getCuratedSkillsSources();
@@ -2507,7 +2969,7 @@ async function main(options = {}) {
 
       const sources = [...curatedSources, ...customSources];
 
-      const discovered = discoverSkills(workingDirectory);
+      const discovered = discoverSkills(directory);
       const installedByName = new Map(discovered.map((s) => [s.name, s]));
 
       const itemsBySource = {};
@@ -2611,12 +3073,16 @@ async function main(options = {}) {
         conflictDecisions,
       } = req.body || {};
 
-      const workingDirectory = req.query.directory;
-      if (scope === 'project' && !workingDirectory) {
-        return res.status(400).json({
-          ok: false,
-          error: { kind: 'invalidSource', message: 'Project installs require a directory parameter' },
-        });
+      let workingDirectory = null;
+      if (scope === 'project') {
+        const resolved = await resolveProjectDirectory(req);
+        if (!resolved.directory) {
+          return res.status(400).json({
+            ok: false,
+            error: { kind: 'invalidSource', message: resolved.error || 'Project installs require a directory parameter' },
+          });
+        }
+        workingDirectory = resolved.directory;
       }
       const identity = resolveGitIdentity(gitIdentityId);
 
@@ -2658,11 +3124,14 @@ async function main(options = {}) {
   });
 
   // Get single skill sources
-  app.get('/api/config/skills/:name', (req, res) => {
+  app.get('/api/config/skills/:name', async (req, res) => {
     try {
       const skillName = req.params.name;
-      const workingDirectory = req.query.directory || openCodeWorkingDirectory;
-      const sources = getSkillSources(skillName, workingDirectory);
+      const { directory, error } = await resolveProjectDirectory(req);
+      if (!directory) {
+        return res.status(400).json({ error });
+      }
+      const sources = getSkillSources(skillName, directory);
 
       res.json({
         name: skillName,
@@ -2678,13 +3147,16 @@ async function main(options = {}) {
   });
 
   // Get skill supporting file content
-  app.get('/api/config/skills/:name/files/*filePath', (req, res) => {
+  app.get('/api/config/skills/:name/files/*filePath', async (req, res) => {
     try {
       const skillName = req.params.name;
       const filePath = decodeURIComponent(req.params.filePath); // Decode URL-encoded path
-      const workingDirectory = req.query.directory || openCodeWorkingDirectory;
+      const { directory, error } = await resolveProjectDirectory(req);
+      if (!directory) {
+        return res.status(400).json({ error });
+      }
       
-      const sources = getSkillSources(skillName, workingDirectory);
+      const sources = getSkillSources(skillName, directory);
       if (!sources.md.exists || !sources.md.dir) {
         return res.status(404).json({ error: 'Skill not found' });
       }
@@ -2706,12 +3178,15 @@ async function main(options = {}) {
     try {
       const skillName = req.params.name;
       const { scope, ...config } = req.body;
-      const workingDirectory = req.query.directory || openCodeWorkingDirectory;
+      const { directory, error } = await resolveProjectDirectory(req);
+      if (!directory) {
+        return res.status(400).json({ error });
+      }
 
       console.log('[Server] Creating skill:', skillName);
-      console.log('[Server] Scope:', scope, 'Working directory:', workingDirectory);
+      console.log('[Server] Scope:', scope, 'Working directory:', directory);
 
-      createSkill(skillName, config, workingDirectory, scope);
+      createSkill(skillName, config, directory, scope);
       // Skills are just files - OpenCode loads them on-demand, no restart needed
 
       res.json({
@@ -2730,12 +3205,15 @@ async function main(options = {}) {
     try {
       const skillName = req.params.name;
       const updates = req.body;
-      const workingDirectory = req.query.directory || openCodeWorkingDirectory;
+      const { directory, error } = await resolveProjectDirectory(req);
+      if (!directory) {
+        return res.status(400).json({ error });
+      }
 
       console.log(`[Server] Updating skill: ${skillName}`);
-      console.log('[Server] Working directory:', workingDirectory);
+      console.log('[Server] Working directory:', directory);
 
-      updateSkill(skillName, updates, workingDirectory);
+      updateSkill(skillName, updates, directory);
       // Skills are just files - OpenCode loads them on-demand, no restart needed
 
       res.json({
@@ -2755,9 +3233,12 @@ async function main(options = {}) {
       const skillName = req.params.name;
       const filePath = decodeURIComponent(req.params.filePath); // Decode URL-encoded path
       const { content } = req.body;
-      const workingDirectory = req.query.directory || openCodeWorkingDirectory;
+      const { directory, error } = await resolveProjectDirectory(req);
+      if (!directory) {
+        return res.status(400).json({ error });
+      }
       
-      const sources = getSkillSources(skillName, workingDirectory);
+      const sources = getSkillSources(skillName, directory);
       if (!sources.md.exists || !sources.md.dir) {
         return res.status(404).json({ error: 'Skill not found' });
       }
@@ -2779,9 +3260,12 @@ async function main(options = {}) {
     try {
       const skillName = req.params.name;
       const filePath = decodeURIComponent(req.params.filePath); // Decode URL-encoded path
-      const workingDirectory = req.query.directory || openCodeWorkingDirectory;
+      const { directory, error } = await resolveProjectDirectory(req);
+      if (!directory) {
+        return res.status(400).json({ error });
+      }
       
-      const sources = getSkillSources(skillName, workingDirectory);
+      const sources = getSkillSources(skillName, directory);
       if (!sources.md.exists || !sources.md.dir) {
         return res.status(404).json({ error: 'Skill not found' });
       }
@@ -2802,9 +3286,12 @@ async function main(options = {}) {
   app.delete('/api/config/skills/:name', async (req, res) => {
     try {
       const skillName = req.params.name;
-      const workingDirectory = req.query.directory || openCodeWorkingDirectory;
+      const { directory, error } = await resolveProjectDirectory(req);
+      if (!directory) {
+        return res.status(400).json({ error });
+      }
 
-      deleteSkill(skillName, workingDirectory);
+      deleteSkill(skillName, directory);
       // Skills are just files - OpenCode loads them on-demand, no restart needed
 
       res.json({
@@ -3331,6 +3818,30 @@ async function main(options = {}) {
     }
   });
 
+
+  app.put('/api/git/branches/rename', async (req, res) => {
+    const { renameBranch } = await getGitLibraries();
+    try {
+      const directory = req.query.directory;
+      if (!directory) {
+        return res.status(400).json({ error: 'directory parameter is required' });
+      }
+
+      const { oldName, newName } = req.body;
+      if (!oldName) {
+        return res.status(400).json({ error: 'oldName is required' });
+      }
+      if (!newName) {
+        return res.status(400).json({ error: 'newName is required' });
+      }
+
+      const result = await renameBranch(directory, oldName, newName);
+      res.json(result);
+    } catch (error) {
+      console.error('Failed to rename branch:', error);
+      res.status(500).json({ error: error.message || 'Failed to rename branch' });
+    }
+  });
   app.delete('/api/git/remote-branches', async (req, res) => {
     const { deleteRemoteBranch } = await getGitLibraries();
     try {
@@ -3543,47 +4054,326 @@ async function main(options = {}) {
     }
   });
 
-  app.post('/api/opencode/directory', async (req, res) => {
+  // Read file contents
+  app.get('/api/fs/read', async (req, res) => {
+    const filePath = typeof req.query.path === 'string' ? req.query.path.trim() : '';
+    if (!filePath) {
+      return res.status(400).json({ error: 'Path is required' });
+    }
+
     try {
-      const requestedPath = typeof req.body?.path === 'string' ? req.body.path.trim() : '';
-      if (!requestedPath) {
-        return res.status(400).json({ error: 'Path is required' });
+      const resolvedPath = path.resolve(normalizeDirectoryPath(filePath));
+      if (resolvedPath.includes('..')) {
+        return res.status(400).json({ error: 'Invalid path: path traversal not allowed' });
+      }
+
+      const stats = await fsPromises.stat(resolvedPath);
+      if (!stats.isFile()) {
+        return res.status(400).json({ error: 'Specified path is not a file' });
+      }
+
+      const content = await fsPromises.readFile(resolvedPath, 'utf8');
+      res.type('text/plain').send(content);
+    } catch (error) {
+      const err = error;
+      if (err && typeof err === 'object' && err.code === 'ENOENT') {
+        return res.status(404).json({ error: 'File not found' });
+      }
+      if (err && typeof err === 'object' && err.code === 'EACCES') {
+        return res.status(403).json({ error: 'Access to file denied' });
+      }
+      console.error('Failed to read file:', error);
+      res.status(500).json({ error: (error && error.message) || 'Failed to read file' });
+    }
+  });
+
+  // Write file contents
+  app.post('/api/fs/write', async (req, res) => {
+    const { path: filePath, content } = req.body || {};
+    if (!filePath || typeof filePath !== 'string') {
+      return res.status(400).json({ error: 'Path is required' });
+    }
+    if (typeof content !== 'string') {
+      return res.status(400).json({ error: 'Content is required' });
+    }
+
+    try {
+      const resolvedPath = path.resolve(normalizeDirectoryPath(filePath));
+      if (resolvedPath.includes('..')) {
+        return res.status(400).json({ error: 'Invalid path: path traversal not allowed' });
+      }
+
+      // Ensure parent directory exists
+      await fsPromises.mkdir(path.dirname(resolvedPath), { recursive: true });
+      await fsPromises.writeFile(resolvedPath, content, 'utf8');
+      res.json({ success: true, path: resolvedPath });
+    } catch (error) {
+      const err = error;
+      if (err && typeof err === 'object' && err.code === 'EACCES') {
+        return res.status(403).json({ error: 'Access denied' });
+      }
+      console.error('Failed to write file:', error);
+      res.status(500).json({ error: (error && error.message) || 'Failed to write file' });
+    }
+  });
+
+  // Execute shell commands in a directory (for worktree setup)
+  // NOTE: This route supports background execution to avoid tying up browser connections.
+  const execJobs = new Map();
+  const EXEC_JOB_TTL_MS = 30 * 60 * 1000;
+  const COMMAND_TIMEOUT_MS = 60000;
+
+  const pruneExecJobs = () => {
+    const now = Date.now();
+    for (const [jobId, job] of execJobs.entries()) {
+      if (!job || typeof job !== 'object') {
+        execJobs.delete(jobId);
+        continue;
+      }
+      const updatedAt = typeof job.updatedAt === 'number' ? job.updatedAt : 0;
+      if (updatedAt && now - updatedAt > EXEC_JOB_TTL_MS) {
+        execJobs.delete(jobId);
+      }
+    }
+  };
+
+  const runCommandInDirectory = (shell, shellFlag, command, resolvedCwd) => {
+    return new Promise((resolve) => {
+      let stdout = '';
+      let stderr = '';
+      let timedOut = false;
+
+      const child = spawn(shell, [shellFlag, command], {
+        cwd: resolvedCwd,
+        env: process.env,
+        stdio: ['ignore', 'pipe', 'pipe'],
+      });
+
+      const timeout = setTimeout(() => {
+        timedOut = true;
+        try {
+          child.kill('SIGKILL');
+        } catch {
+          // ignore
+        }
+      }, COMMAND_TIMEOUT_MS);
+
+      child.stdout?.on('data', (chunk) => {
+        stdout += chunk.toString();
+      });
+
+      child.stderr?.on('data', (chunk) => {
+        stderr += chunk.toString();
+      });
+
+      child.on('error', (error) => {
+        clearTimeout(timeout);
+        resolve({
+          command,
+          success: false,
+          exitCode: undefined,
+          stdout: stdout.trim(),
+          stderr: stderr.trim(),
+          error: (error && error.message) || 'Command execution failed',
+        });
+      });
+
+      child.on('close', (code, signal) => {
+        clearTimeout(timeout);
+        const exitCode = typeof code === 'number' ? code : undefined;
+        const base = {
+          command,
+          success: exitCode === 0 && !timedOut,
+          exitCode,
+          stdout: stdout.trim(),
+          stderr: stderr.trim(),
+        };
+
+        if (timedOut) {
+          resolve({
+            ...base,
+            success: false,
+            error: `Command timed out after ${COMMAND_TIMEOUT_MS}ms` + (signal ? ` (${signal})` : ''),
+          });
+          return;
+        }
+
+        resolve(base);
+      });
+    });
+  };
+
+  const runExecJob = async (job) => {
+    job.status = 'running';
+    job.updatedAt = Date.now();
+
+    const results = [];
+
+    for (const command of job.commands) {
+      if (typeof command !== 'string' || !command.trim()) {
+        results.push({ command, success: false, error: 'Invalid command' });
+        continue;
       }
 
-      const resolvedPath = path.resolve(normalizeDirectoryPath(requestedPath));
-      let stats;
       try {
-        stats = await fsPromises.stat(resolvedPath);
+        const result = await runCommandInDirectory(job.shell, job.shellFlag, command, job.resolvedCwd);
+        results.push(result);
       } catch (error) {
-        const err = error;
-        if (err && typeof err === 'object' && 'code' in err) {
-          if (err.code === 'ENOENT') {
-            return res.status(404).json({ error: 'Directory not found' });
-          }
-          if (err.code === 'EACCES') {
-            return res.status(403).json({ error: 'Access to directory denied' });
-          }
-        }
-        throw error;
+        results.push({
+          command,
+          success: false,
+          error: (error && error.message) || 'Command execution failed',
+        });
       }
 
+      job.results = results;
+      job.updatedAt = Date.now();
+    }
+
+    job.results = results;
+    job.success = results.every((r) => r.success);
+    job.status = 'done';
+    job.finishedAt = Date.now();
+    job.updatedAt = Date.now();
+  };
+
+  app.post('/api/fs/exec', async (req, res) => {
+    const { commands, cwd, background } = req.body || {};
+    if (!Array.isArray(commands) || commands.length === 0) {
+      return res.status(400).json({ error: 'Commands array is required' });
+    }
+    if (!cwd || typeof cwd !== 'string') {
+      return res.status(400).json({ error: 'Working directory (cwd) is required' });
+    }
+
+    pruneExecJobs();
+
+    try {
+      const resolvedCwd = path.resolve(normalizeDirectoryPath(cwd));
+      const stats = await fsPromises.stat(resolvedCwd);
       if (!stats.isDirectory()) {
-        return res.status(400).json({ error: 'Specified path is not a directory' });
+        return res.status(400).json({ error: 'Specified cwd is not a directory' });
       }
 
-      if (openCodeWorkingDirectory === resolvedPath && openCodeProcess && openCodeProcess.exitCode === null) {
-        return res.json({ success: true, restarted: false, path: resolvedPath });
+      const shell = process.env.SHELL || (process.platform === 'win32' ? 'cmd.exe' : '/bin/sh');
+      const shellFlag = process.platform === 'win32' ? '/c' : '-c';
+
+      const jobId = crypto.randomUUID();
+      const job = {
+        jobId,
+        status: 'queued',
+        success: null,
+        commands,
+        resolvedCwd,
+        shell,
+        shellFlag,
+        results: [],
+        startedAt: Date.now(),
+        finishedAt: null,
+        updatedAt: Date.now(),
+      };
+
+      execJobs.set(jobId, job);
+
+      const isBackground = background === true;
+      if (isBackground) {
+        void runExecJob(job).catch((error) => {
+          job.status = 'done';
+          job.success = false;
+          job.results = Array.isArray(job.results) ? job.results : [];
+          job.results.push({
+            command: '',
+            success: false,
+            error: (error && error.message) || 'Command execution failed',
+          });
+          job.finishedAt = Date.now();
+          job.updatedAt = Date.now();
+        });
+
+        return res.status(202).json({
+          jobId,
+          status: 'running',
+        });
       }
 
-      openCodeWorkingDirectory = resolvedPath;
-      syncToHmrState();
+      await runExecJob(job);
+      res.json({
+        jobId,
+        status: job.status,
+        success: job.success === true,
+        results: job.results,
+      });
+    } catch (error) {
+      console.error('Failed to execute commands:', error);
+      res.status(500).json({ error: (error && error.message) || 'Failed to execute commands' });
+    }
+  });
+
+  app.get('/api/fs/exec/:jobId', (req, res) => {
+    const jobId = typeof req.params?.jobId === 'string' ? req.params.jobId : '';
+    if (!jobId) {
+      return res.status(400).json({ error: 'Job id is required' });
+    }
+
+    pruneExecJobs();
+
+    const job = execJobs.get(jobId);
+    if (!job) {
+      return res.status(404).json({ error: 'Job not found' });
+    }
+
+    job.updatedAt = Date.now();
+
+    return res.json({
+      jobId: job.jobId,
+      status: job.status,
+      success: job.success === true,
+      results: Array.isArray(job.results) ? job.results : [],
+    });
+  });
+
+  app.post('/api/opencode/directory', async (req, res) => {
+    try {
+      const requestedPath = typeof req.body?.path === 'string' ? req.body.path.trim() : '';
+      if (!requestedPath) {
+        return res.status(400).json({ error: 'Path is required' });
+      }
 
-      await refreshOpenCodeAfterConfigChange('directory change');
+      const validated = await validateDirectoryPath(requestedPath);
+      if (!validated.ok) {
+        return res.status(400).json({ error: validated.error });
+      }
+
+      const resolvedPath = validated.directory;
+      const currentSettings = await readSettingsFromDisk();
+      const existingProjects = sanitizeProjects(currentSettings.projects) || [];
+      const existing = existingProjects.find((project) => project.path === resolvedPath) || null;
+
+      const nextProjects = existing
+        ? existingProjects
+        : [
+            ...existingProjects,
+            {
+              id: crypto.randomUUID(),
+              path: resolvedPath,
+              addedAt: Date.now(),
+              lastOpenedAt: Date.now(),
+            },
+          ];
+
+      const activeProjectId = existing ? existing.id : nextProjects[nextProjects.length - 1].id;
+
+      const updated = await persistSettings({
+        projects: nextProjects,
+        activeProjectId,
+        lastDirectory: resolvedPath,
+      });
 
       res.json({
         success: true,
-        restarted: true,
-        path: resolvedPath
+        restarted: false,
+        path: resolvedPath,
+        settings: updated,
       });
     } catch (error) {
       console.error('Failed to update OpenCode working directory:', error);